---
title: "Process of developing IS security plan"
subject: "Information System"
chapter: 2
key: "semester_8/information_system:is-security-plan"
source: https://www.bctengineer.com/q/semester_8/information_system/is-security-plan
site: BCT Engineering
---

# Process of developing IS security plan

Information System · Chapter 2: Control, Audit and Security of Information Systems

- Asked in: 2074 Magh, 4 marks
- Video: [WHAT GOES INTO AN INFORMATION SECURITY PLAN?](https://www.youtube.com/watch?v=UeemPn-Yytg) — Bill Osolinski CISSP
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/information_system/is-security-plan
- Whole chapter: https://www.bctengineer.com/md/semester_8/information_system/chapter-2

## Question

Explain the process of developing an I.S. security plan.

## Short answer

Developing an IS security plan begins with defining scope and identifying assets, threats and vulnerabilities. After risk assessment, security policy and controls (physical, technical, administrative) are selected, followed by contingency plans. The plan is implemented, tested through audits and drills, and regularly reviewed to adapt to new threats.

## Answer

An **IS security plan** is a documented strategy that defines what must be protected, from which threats, using which controls, and who is responsible. It is developed as a continuous cycle.

```text
 Identify assets -> Assess risk -> Set policy
        ^                              |
 Review/Audit <- Implement <- Select controls
```

#### Steps
1. **Define scope and obtain management support** - decide which systems, data and locations are covered; get budget and commitment.
2. **Identify and classify assets** - hardware, software, data, people; rank by value and sensitivity.
3. **Identify threats and vulnerabilities** - malware, hacking, insider misuse, natural disaster, weak configuration.
4. **Risk assessment** - estimate likelihood and impact of each threat; prioritise risks.
5. **Set security policy and objectives** - rules for access, passwords, acceptable use, backup, incident handling.
6. **Select controls** - physical, technical (firewall, encryption, authentication) and administrative (training, separation of duties), by cost versus risk reduction.
7. **Prepare contingency plans** - backup, disaster recovery and business continuity plans.
8. **Implement the plan** - assign roles, install controls, train staff.
9. **Test, monitor and audit** - penetration tests, audit logs, drills.
10. **Review and update** regularly as technology and threats change.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What should come first in developing an IS security plan?
   A. Define scope and obtain management support
   B. Test the controls
   C. Select antivirus software
   D. Review and update
   Answer: A. Budget and commitment are needed before assets and risks are assessed. (Key point: First steps)

2. What does risk assessment involve?
   A. Installing firewalls
   B. Estimating likelihood and impact of each threat and prioritising
   C. Training staff
   D. Writing the user manual
   Answer: B. It prioritises risks so controls match them. (Key point: Risk assessment)

3. On what basis are controls selected?
   A. Whatever is most popular
   B. Only the cheapest option
   C. Cost versus risk reduction
   D. Only technical controls
   Answer: C. Controls can be physical, technical and administrative. (Key point: Selecting controls)

4. Why is the last step review and update?
   A. The plan is finished once written
   B. Only to reduce audit cost
   C. Because policies must be deleted yearly
   D. Technology and threats change, so the plan is a continuous cycle
   Answer: D. Test, monitor, audit and review keep the plan effective. (Key point: Continuous cycle)

## Related in other subjects

- [Plan, importance, systematic planning process](https://www.bctengineer.com/question.md?key=semester_7%2Fproject_engineering%3Aplan-importance-planning-process) — Project Engineering, chapter 3
- [Baseline management in project plan](https://www.bctengineer.com/question.md?key=semester_7%2Fict_project_management%3Abaseline-management) — ICT Project Management, chapter 7
- [Software process models and effort estimation](https://www.bctengineer.com/question.md?key=semester_5%2Finstrumentation_ii%3Asw-process-models) — Instrumentation II, chapter 9, asked 2×